sorry, followup: is this how we would pass the context to the caveat? > assertTrue: > resource:someresource#somerelation@user:someuser with { "now": "current timestamp" } (assuming the caveat compares the expiration with "now")? I'm asking because the caveat doesn't take named parameters so I'm not sure how the mapping works.